5d17d24f98ba5a9e9721f7ddd125c596aa043e88153b7a8483635fd23c4b67a4

Analysis

max time kernel
151s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 07:34

Target

1242f0085d300bbc7f1d81d54f0c00b2.exe
Size

961KB
MD5

1242f0085d300bbc7f1d81d54f0c00b2
SHA1

a263ed831df976ff606e751da57a3ebad6381978
SHA256

5d17d24f98ba5a9e9721f7ddd125c596aa043e88153b7a8483635fd23c4b67a4
SHA512

164cdbdfaf574445ce783e27a6480bd5124b0f1454f8c373ddb9269cfe65a3f28d73d0aae43fa629576d88eafcca3baf40cfa37c5ccea71bfe25376ca0c6cc3e
SSDEEP

24576:7zXKqa8SEijjC+37u9BEqxt5VUsftMQtadUj/DaxOiPKU:7z6qaakjC+3aNxJU2XtadsuYQ

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
4996	wrjfzdisw.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\wedtiblfp\wrjfzdisw.exe	1242f0085d300bbc7f1d81d54f0c00b2.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4996	4020	1242f0085d300bbc7f1d81d54f0c00b2.exe	82
PID 4020 wrote to memory of 4996	4020	1242f0085d300bbc7f1d81d54f0c00b2.exe	82
PID 4020 wrote to memory of 4996	4020	1242f0085d300bbc7f1d81d54f0c00b2.exe	82

C:\Users\Admin\AppData\Local\Temp\1242f0085d300bbc7f1d81d54f0c00b2.exe
"C:\Users\Admin\AppData\Local\Temp\1242f0085d300bbc7f1d81d54f0c00b2.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\wedtiblfp\wrjfzdisw.exe
  "C:\Program Files (x86)\wedtiblfp\wrjfzdisw.exe"
  2⤵
  - Executes dropped EXE
  PID:4996

memory/4020-0-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4020-1-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4020-6-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4996-9-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download
memory/4996-8-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download